What kinds of applications is uni-directional proxy re-encryption applicable to?
I learned some applications that proxy re-encryption can be used, which are email and file sharing scenarios.
All of the scenarios that I am aware do make sense when we use bidirectional proxy re encryption. When would uni-directional proxy re encryption can make sense?
In bidirectional proxy re-encryption, there's an efficient algorithm to transform a re-encryption key from Alice to Bob in a re-encryption key from Bob to Alice. For example, the BBS98 proxy re-encryption scheme has re-encryption keys of the form $rk_{A \to B} = \frac{b}{a}$, where $a$ and $b$ are the private keys of Alice and Bob, respectively; it is easy to see that this scheme is bidirectional, since the algorithm to transform $rk_{A \to B}$ into $rk_{B \to A}$ is simply the modular inversion: $$rk_{B \to A} = (rk_{A \to B})^{-1} = (\frac{b}{a})^{-1} = \frac{a}{b}$$
Now, let's recall what's the main functionality of PRE: secure delegation of decryption rights from one user (Alice) to another (Bob). We usually think of unidirectional PRE schemes since in most cases the delegation is inherently unidirectional. For instance, in the typical email example, I can delegate decryption rights to my secretary while I'm on holidays so he can decrypt my emails. This, however, doesn't mean that my secretary wants me to be able to read encrypted emails directed to him. Similarly, in a file sharing scenario, I may share some encrypted documents with you, but you don't necessarily want to do the same with me.
Hence, bidirectional PRE schemes are only useful when there's a complete symmetry in the trust relationship between Alice and Bob. This may happen in some scenarios, but it's not common.
